@haven_ai/connect 0.1.12-alpha.0 → 0.1.13-alpha.0

package/dist/index.d.cts

@@ -160,6 +160,42 @@ interface PreparedLocalMcpRuntime {
     messages: string[];
 }
 
+interface PrepareSignerRuntimeInput {
+    credentialDirectory: string;
+    signerPath: string;
+    homeDir?: string;
+}
+interface PreparedSignerRuntime {
+    /** Absolute command to register as the signer MCP `command`. */
+    command: string;
+    /** Args to register alongside `command` (credentials are baked into the wrapper). */
+    args: string[];
+    wrapperPath: string;
+    runtimeDirectory: string;
+    npmCacheDirectory: string;
+    cliPath: string;
+    messages: string[];
+}
+interface SignerRuntimeDeps {
+    runCommand?: (command: string, args: string[]) => Promise<void>;
+}
+/**
+ * Pre-install the edge signer into a version-pinned, connector-managed
+ * directory and write a stable wrapper that launches it with an absolute Node
+ * path. The signer MCP is then registered as `command: <wrapper>` instead of a
+ * runtime `npx -y @haven_ai/signer@…` invocation.
+ *
+ * Why: launching the signer via bare `npx` at every MCP spawn made it depend on
+ * the PATH/environment the agent runtime hands the stdio subprocess, which is
+ * not the user's interactive shell — the failure mode that left `haven-signer`
+ * stuck at "Failed to connect" while the hosted HTTP server connected fine. The
+ * local MCP topology already avoids this with the same pre-install + wrapper
+ * pattern (see prepareLocalMcpRuntime); this brings the default hosted+signer
+ * topology to parity. Version stays pinned (no unpinned `npm i -g`), and the
+ * wrapper lives under ~/.haven so the reset flow already cleans it up.
+ */
+declare function prepareSignerRuntime(input: PrepareSignerRuntimeInput, deps?: SignerRuntimeDeps): Promise<PreparedSignerRuntime>;
+
 interface RuntimeInstallInput {
     runtime?: string;
     hostedMcpUrl: string;
@@ -193,6 +229,14 @@ interface RuntimeInstallResult {
     localMcpAcknowledged?: boolean;
     activationCommand?: string;
     skillInstalled?: boolean;
+    /**
+     * Hosted topology only: true when the signer was pre-installed and registered
+     * via its absolute wrapper, false when prep failed and it fell back to the
+     * fragile runtime-`npx` launch. Undefined for local/manual topologies that
+     * do not run the signer as a separate MCP. Lets callers/tests detect the
+     * silent npx fallback instead of treating every write as fully healthy.
+     */
+    signerRuntimePrepared?: boolean;
     messages: string[];
 }
 interface RuntimeInstallDeps {
@@ -201,6 +245,7 @@ interface RuntimeInstallDeps {
     fetch?: typeof fetch;
     runCommand?: (command: string, args: string[]) => Promise<void>;
     prepareLocalMcpRuntime?: (input: PrepareLocalMcpRuntimeInput) => Promise<PreparedLocalMcpRuntime>;
+    prepareSignerRuntime?: (input: PrepareSignerRuntimeInput) => Promise<PreparedSignerRuntime>;
     probeLocalMcpTools?: (command: string, args: string[], requiredTools: readonly string[]) => Promise<LocalMcpProbeResult>;
 }
 declare function installRuntime(input: RuntimeInstallInput, deps?: RuntimeInstallDeps): Promise<RuntimeInstallResult>;
@@ -209,7 +254,7 @@ declare function runtimeInstallCapabilities(runtime: string | undefined, env?: N
     restartRequired: boolean;
 };
 
-declare const CONNECTOR_VERSION = "0.1.12-alpha.0";
+declare const CONNECTOR_VERSION = "0.1.13-alpha.0";
 interface ConnectOptions {
     setupToken: string;
     apiBaseUrl: string;
@@ -250,11 +295,11 @@ declare function shortAddress(address: string): string;
 
 declare const MCP_RUNTIME_MANIFEST: {
     readonly mcpPackage: "@haven_ai/mcp";
-    readonly mcpVersion: "0.1.12-alpha.0";
+    readonly mcpVersion: "0.1.13-alpha.0";
     readonly sdkPackage: "@haven_ai/sdk";
-    readonly sdkVersion: "0.1.12-alpha.0";
+    readonly sdkVersion: "0.1.13-alpha.0";
     readonly signerPackage: "@haven_ai/signer";
-    readonly signerVersion: "0.1.12-alpha.0";
+    readonly signerVersion: "0.1.13-alpha.0";
     readonly minimumNodeVersion: "20.0.0";
     readonly supportedClients: readonly ["codex-cli", "codex-desktop", "claude-code"];
     readonly requiredTools: readonly string[];
@@ -263,4 +308,4 @@ declare function mcpPackageSpec(): string;
 declare function sdkPackageSpec(): string;
 declare function signerPackageSpec(): string;
 
-export { CONNECTOR_VERSION, type ConnectApiClient, type ConnectDeps, type ConnectOptions, type ConnectResult, type LocalDelegateKey, MCP_RUNTIME_MANIFEST, type RegisterSetupInput, type RegisterSetupResponse, type ResolveSetupInput, type ResolvedSetup, type RuntimeId, type RuntimeInstallInput, type RuntimeInstallResult, type RuntimeProfile, type StoredCredentialPaths, type UpdateInstallStatusInput, type WriteCredentialInput, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };
+export { CONNECTOR_VERSION, type ConnectApiClient, type ConnectDeps, type ConnectOptions, type ConnectResult, type LocalDelegateKey, MCP_RUNTIME_MANIFEST, type PrepareSignerRuntimeInput, type PreparedSignerRuntime, type RegisterSetupInput, type RegisterSetupResponse, type ResolveSetupInput, type ResolvedSetup, type RuntimeId, type RuntimeInstallInput, type RuntimeInstallResult, type RuntimeProfile, type StoredCredentialPaths, type UpdateInstallStatusInput, type WriteCredentialInput, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, prepareSignerRuntime, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };

package/dist/index.d.ts

@@ -160,6 +160,42 @@ interface PreparedLocalMcpRuntime {
     messages: string[];
 }
 
+interface PrepareSignerRuntimeInput {
+    credentialDirectory: string;
+    signerPath: string;
+    homeDir?: string;
+}
+interface PreparedSignerRuntime {
+    /** Absolute command to register as the signer MCP `command`. */
+    command: string;
+    /** Args to register alongside `command` (credentials are baked into the wrapper). */
+    args: string[];
+    wrapperPath: string;
+    runtimeDirectory: string;
+    npmCacheDirectory: string;
+    cliPath: string;
+    messages: string[];
+}
+interface SignerRuntimeDeps {
+    runCommand?: (command: string, args: string[]) => Promise<void>;
+}
+/**
+ * Pre-install the edge signer into a version-pinned, connector-managed
+ * directory and write a stable wrapper that launches it with an absolute Node
+ * path. The signer MCP is then registered as `command: <wrapper>` instead of a
+ * runtime `npx -y @haven_ai/signer@…` invocation.
+ *
+ * Why: launching the signer via bare `npx` at every MCP spawn made it depend on
+ * the PATH/environment the agent runtime hands the stdio subprocess, which is
+ * not the user's interactive shell — the failure mode that left `haven-signer`
+ * stuck at "Failed to connect" while the hosted HTTP server connected fine. The
+ * local MCP topology already avoids this with the same pre-install + wrapper
+ * pattern (see prepareLocalMcpRuntime); this brings the default hosted+signer
+ * topology to parity. Version stays pinned (no unpinned `npm i -g`), and the
+ * wrapper lives under ~/.haven so the reset flow already cleans it up.
+ */
+declare function prepareSignerRuntime(input: PrepareSignerRuntimeInput, deps?: SignerRuntimeDeps): Promise<PreparedSignerRuntime>;
+
 interface RuntimeInstallInput {
     runtime?: string;
     hostedMcpUrl: string;
@@ -193,6 +229,14 @@ interface RuntimeInstallResult {
     localMcpAcknowledged?: boolean;
     activationCommand?: string;
     skillInstalled?: boolean;
+    /**
+     * Hosted topology only: true when the signer was pre-installed and registered
+     * via its absolute wrapper, false when prep failed and it fell back to the
+     * fragile runtime-`npx` launch. Undefined for local/manual topologies that
+     * do not run the signer as a separate MCP. Lets callers/tests detect the
+     * silent npx fallback instead of treating every write as fully healthy.
+     */
+    signerRuntimePrepared?: boolean;
     messages: string[];
 }
 interface RuntimeInstallDeps {
@@ -201,6 +245,7 @@ interface RuntimeInstallDeps {
     fetch?: typeof fetch;
     runCommand?: (command: string, args: string[]) => Promise<void>;
     prepareLocalMcpRuntime?: (input: PrepareLocalMcpRuntimeInput) => Promise<PreparedLocalMcpRuntime>;
+    prepareSignerRuntime?: (input: PrepareSignerRuntimeInput) => Promise<PreparedSignerRuntime>;
     probeLocalMcpTools?: (command: string, args: string[], requiredTools: readonly string[]) => Promise<LocalMcpProbeResult>;
 }
 declare function installRuntime(input: RuntimeInstallInput, deps?: RuntimeInstallDeps): Promise<RuntimeInstallResult>;
@@ -209,7 +254,7 @@ declare function runtimeInstallCapabilities(runtime: string | undefined, env?: N
     restartRequired: boolean;
 };
 
-declare const CONNECTOR_VERSION = "0.1.12-alpha.0";
+declare const CONNECTOR_VERSION = "0.1.13-alpha.0";
 interface ConnectOptions {
     setupToken: string;
     apiBaseUrl: string;
@@ -250,11 +295,11 @@ declare function shortAddress(address: string): string;
 
 declare const MCP_RUNTIME_MANIFEST: {
     readonly mcpPackage: "@haven_ai/mcp";
-    readonly mcpVersion: "0.1.12-alpha.0";
+    readonly mcpVersion: "0.1.13-alpha.0";
     readonly sdkPackage: "@haven_ai/sdk";
-    readonly sdkVersion: "0.1.12-alpha.0";
+    readonly sdkVersion: "0.1.13-alpha.0";
     readonly signerPackage: "@haven_ai/signer";
-    readonly signerVersion: "0.1.12-alpha.0";
+    readonly signerVersion: "0.1.13-alpha.0";
     readonly minimumNodeVersion: "20.0.0";
     readonly supportedClients: readonly ["codex-cli", "codex-desktop", "claude-code"];
     readonly requiredTools: readonly string[];
@@ -263,4 +308,4 @@ declare function mcpPackageSpec(): string;
 declare function sdkPackageSpec(): string;
 declare function signerPackageSpec(): string;
 
-export { CONNECTOR_VERSION, type ConnectApiClient, type ConnectDeps, type ConnectOptions, type ConnectResult, type LocalDelegateKey, MCP_RUNTIME_MANIFEST, type RegisterSetupInput, type RegisterSetupResponse, type ResolveSetupInput, type ResolvedSetup, type RuntimeId, type RuntimeInstallInput, type RuntimeInstallResult, type RuntimeProfile, type StoredCredentialPaths, type UpdateInstallStatusInput, type WriteCredentialInput, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };
+export { CONNECTOR_VERSION, type ConnectApiClient, type ConnectDeps, type ConnectOptions, type ConnectResult, type LocalDelegateKey, MCP_RUNTIME_MANIFEST, type PrepareSignerRuntimeInput, type PreparedSignerRuntime, type RegisterSetupInput, type RegisterSetupResponse, type ResolveSetupInput, type ResolvedSetup, type RuntimeId, type RuntimeInstallInput, type RuntimeInstallResult, type RuntimeProfile, type StoredCredentialPaths, type UpdateInstallStatusInput, type WriteCredentialInput, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, prepareSignerRuntime, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };

package/dist/index.js

@@ -208,9 +208,9 @@ var MCP_RUNTIME_MANIFEST = {
   mcpPackage: "@haven_ai/mcp",
   mcpVersion: MCP_VERSION,
   sdkPackage: "@haven_ai/sdk",
-  sdkVersion: "0.1.12-alpha.0",
+  sdkVersion: "0.1.13-alpha.0",
   signerPackage: "@haven_ai/signer",
-  signerVersion: "0.1.12-alpha.0",
+  signerVersion: "0.1.13-alpha.0",
   minimumNodeVersion: "20.0.0",
   supportedClients: ["codex-cli", "codex-desktop", "claude-code"],
   requiredTools: registeredToolNames()
@@ -383,10 +383,16 @@ function buildHostedServer(hostedMcpUrl, apiKey, runtime) {
     headers: { Authorization: `Bearer ${apiKey}` }
   };
 }
-function buildSignerServer(signerPath, runtime) {
-  const server = {
+function resolveSignerLaunchSpec(input) {
+  return input.signerCommand ?? {
     command: "npx",
-    args: ["-y", signerPackageName(), "--credentials", signerPath]
+    args: ["-y", signerPackageSpec(), "--credentials", input.signerPath]
+  };
+}
+function buildSignerServer(spec, runtime) {
+  const server = {
+    command: spec.command,
+    args: spec.args
   };
   if (runtime === "vscode" || runtime === "vscode-insiders") return { type: "stdio", ...server };
   return server;
@@ -419,7 +425,7 @@ function mergeCodexToml(existingToml, localMcpCommand) {
 `;
   return merged;
 }
-function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerPath) {
+function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerSpec) {
   let next = removeTomlTableTree(removeTomlTableTree(existingToml, "mcp_servers.haven"), "mcp_servers.haven_signer");
   next = next.trimEnd();
   const block = [
@@ -428,8 +434,8 @@ function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerPath) {
     `http_headers = { "Authorization" = ${tomlString(`Bearer ${apiKey}`)} }`,
     "",
     "[mcp_servers.haven_signer]",
-    'command = "npx"',
-    `args = ["-y", ${tomlString(signerPackageSpec())}, "--credentials", ${tomlString(signerPath)}]`,
+    `command = ${tomlString(signerSpec.command)}`,
+    `args = [${signerSpec.args.map((arg) => tomlString(arg)).join(", ")}]`,
     "startup_timeout_sec = 120"
   ].join("\n");
   validateCodexToml(block, "Generated Codex Haven config");
@@ -446,7 +452,7 @@ async function writeJsonRuntimeConfig(input, target, serverRoot) {
       existing,
       serverRoot,
       buildHostedServer(input.hostedMcpUrl, input.apiKey, input.runtime),
-      buildSignerServer(input.signerPath, input.runtime)
+      buildSignerServer(resolveSignerLaunchSpec(input), input.runtime)
     );
     await writeOwnerOnlyText(target, merged);
     return {
@@ -502,7 +508,7 @@ async function writeCodexConfig(input) {
         ]
       };
     }
-    const merged = mergeCodexTomlHosted(existing ?? "", input.hostedMcpUrl, input.apiKey, input.signerPath);
+    const merged = mergeCodexTomlHosted(existing ?? "", input.hostedMcpUrl, input.apiKey, resolveSignerLaunchSpec(input));
     await writeOwnerOnlyText(target, merged);
     return {
       hostedConfigured: true,
@@ -787,9 +793,6 @@ function configTargetLabel(runtime) {
       return "runtime MCP config";
   }
 }
-function signerPackageName() {
-  return signerPackageSpec();
-}
 async function acknowledgeLocalMcpConsent(identityPath, signerPath, log) {
   try {
     const input = await buildLocalMcpConsentInput(identityPath, signerPath);
@@ -903,7 +906,7 @@ async function probeLocalSignerCredential(signerPath) {
   }
 }
 async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = spawn(command, args, { stdio: ["pipe", "pipe", "ignore"] });
     let stdout = "";
     let settled = false;
@@ -913,7 +916,7 @@ async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4)
       settled = true;
       clearTimeout(timeout);
       child.kill();
-      resolve7(result);
+      resolve8(result);
     };
     const timeout = setTimeout(() => finish({ status: "timeout" }), timeoutMs);
     child.on("error", () => finish({ status: "process_error" }));
@@ -1151,6 +1154,126 @@ async function assertFileExists(path, label) {
     throw new Error(`Missing ${label}: ${path}`);
   }
 }
+var execFileAsync2 = promisify(execFile);
+async function prepareSignerRuntime(input, deps = {}) {
+  const homeDir = input.homeDir ?? homedir();
+  const runtimeDirectory = resolve(homeDir, ".haven", "signer-runtime", MCP_RUNTIME_MANIFEST.signerVersion);
+  const npmCacheDirectory = resolve(homeDir, ".haven", "npm-cache");
+  const cliPath = join(runtimeDirectory, "node_modules", "@haven_ai", "signer", "dist", "cli.js");
+  const messages = [];
+  await mkdir(runtimeDirectory, { recursive: true, mode: 448 });
+  await chmod(runtimeDirectory, 448).catch(() => void 0);
+  await mkdir(npmCacheDirectory, { recursive: true, mode: 448 });
+  await chmod(npmCacheDirectory, 448).catch(() => void 0);
+  if (await installedRuntimeMatches2(runtimeDirectory, cliPath)) {
+    messages.push(`Using existing local Haven signer runtime ${signerPackageSpec()}.`);
+  } else {
+    await installRuntimePackages2(runtimeDirectory, npmCacheDirectory, deps.runCommand);
+    messages.push(`Installed local Haven signer runtime ${signerPackageSpec()}.`);
+  }
+  await assertFileExists2(cliPath, "local Haven signer CLI");
+  const wrapperPath = join(input.credentialDirectory, "bin", "haven-signer.mjs");
+  await writeWrapper2({ wrapperPath, cliPath, signerPath: input.signerPath });
+  await writeRuntimeSidecar2({
+    path: join(input.credentialDirectory, "signer-runtime.json"),
+    wrapperPath,
+    runtimeDirectory,
+    npmCacheDirectory,
+    cliPath
+  });
+  messages.push(`Prepared stable local Haven signer wrapper: ${wrapperPath}`);
+  return {
+    command: wrapperPath,
+    args: [],
+    wrapperPath,
+    runtimeDirectory,
+    npmCacheDirectory,
+    cliPath,
+    messages
+  };
+}
+async function installRuntimePackages2(runtimeDirectory, npmCacheDirectory, runCommand) {
+  const args = [
+    "install",
+    "--prefix",
+    runtimeDirectory,
+    "--cache",
+    npmCacheDirectory,
+    "--no-audit",
+    "--no-fund",
+    "--omit=dev",
+    signerPackageSpec(),
+    sdkPackageSpec()
+  ];
+  try {
+    if (runCommand) await runCommand("npm", args);
+    else await execFileAsync2("npm", args, { timeout: 12e4, maxBuffer: 1024 * 1024 });
+  } catch (err) {
+    throw new Error(
+      `Could not install local Haven signer runtime ${signerPackageSpec()}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function installedRuntimeMatches2(runtimeDirectory, cliPath) {
+  try {
+    await assertFileExists2(cliPath, "local Haven signer CLI");
+    const [signerPackage, sdkPackage] = await Promise.all([
+      readPackageJson2(join(runtimeDirectory, "node_modules", "@haven_ai", "signer", "package.json")),
+      readPackageJson2(join(runtimeDirectory, "node_modules", "@haven_ai", "sdk", "package.json"))
+    ]);
+    return signerPackage.version === MCP_RUNTIME_MANIFEST.signerVersion && sdkPackage.version === MCP_RUNTIME_MANIFEST.sdkVersion;
+  } catch {
+    return false;
+  }
+}
+async function readPackageJson2(path) {
+  return JSON.parse(await readFile(path, "utf8"));
+}
+async function writeWrapper2(input) {
+  await mkdir(dirname(input.wrapperPath), { recursive: true, mode: 448 });
+  await chmod(dirname(input.wrapperPath), 448).catch(() => void 0);
+  const source = [
+    "#!/usr/bin/env node",
+    "import { spawn } from 'node:child_process'",
+    "",
+    `const cliPath = ${JSON.stringify(input.cliPath)}`,
+    `const signerPath = ${JSON.stringify(input.signerPath)}`,
+    "",
+    "const child = spawn(process.execPath, [cliPath, '--credentials', signerPath, ...process.argv.slice(2)], {",
+    "  stdio: 'inherit',",
+    "})",
+    "",
+    "child.on('exit', (code, signal) => {",
+    "  if (signal) process.kill(process.pid, signal)",
+    "  else process.exit(code ?? 1)",
+    "})",
+    ""
+  ].join("\n");
+  await writeFile(input.wrapperPath, source, { mode: 448 });
+  await chmod(input.wrapperPath, 448).catch(() => void 0);
+}
+async function writeRuntimeSidecar2(input) {
+  const value = {
+    signer_package: MCP_RUNTIME_MANIFEST.signerPackage,
+    signer_version: MCP_RUNTIME_MANIFEST.signerVersion,
+    sdk_package: MCP_RUNTIME_MANIFEST.sdkPackage,
+    sdk_version: MCP_RUNTIME_MANIFEST.sdkVersion,
+    wrapper_path: input.wrapperPath,
+    runtime_directory: input.runtimeDirectory,
+    npm_cache_directory: input.npmCacheDirectory,
+    cli_path: input.cliPath
+  };
+  await writeFile(input.path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  await chmod(input.path, 384).catch(() => void 0);
+}
+async function assertFileExists2(path, label) {
+  try {
+    await access(path);
+  } catch {
+    throw new Error(`Missing ${label}: ${path}`);
+  }
+}
 async function acknowledgeLocalSignerConsent(signerPath, log) {
   try {
     const input = await buildSignerConsentInput(signerPath);
@@ -1222,7 +1345,7 @@ function writeLogChunk2(log, chunk) {
 }
 
 // src/runtime-install.ts
-var execFileAsync2 = promisify(execFile);
+var execFileAsync3 = promisify(execFile);
 async function installRuntime(input, deps = {}) {
   const runtime = normalizeRuntime(input.runtime, deps.env);
   const profile = runtimeProfile(runtime, deps.env);
@@ -1283,7 +1406,20 @@ async function installRuntime(input, deps = {}) {
       ]
     };
   }
-  const configResult = runtime === "claude-code" ? localRuntime ? await configureClaudeCode(deps, localRuntimeInstall?.command ?? "") : await configureClaudeCodeHosted(deps, input) : await writeRuntimeConfig({
+  let signerCommand;
+  if (!localRuntime) {
+    try {
+      const signerRuntime = await prepareSignerForRuntime(input, deps);
+      signerCommand = { command: signerRuntime.command, args: signerRuntime.args };
+      consentMessages.push(...signerRuntime.messages);
+    } catch (err) {
+      consentMessages.push(
+        `Could not pre-install the local Haven signer; falling back to npx launch: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const signerRuntimePrepared = localRuntime ? void 0 : signerCommand !== void 0;
+  const configResult = runtime === "claude-code" ? localRuntime ? await configureClaudeCode(deps, localRuntimeInstall?.command ?? "") : await configureClaudeCodeHosted(deps, input, signerCommand) : await writeRuntimeConfig({
     runtime,
     hostedMcpUrl: input.hostedMcpUrl,
     apiKey: input.apiKey,
@@ -1291,6 +1427,7 @@ async function installRuntime(input, deps = {}) {
     signerPath: input.signerPath,
     credentialDirectory: input.credentialDirectory,
     localMcpCommand: localRuntimeInstall?.command,
+    signerCommand,
     homeDir: deps.homeDir,
     mode: localRuntime ? "local" : "hosted"
   });
@@ -1322,6 +1459,7 @@ async function installRuntime(input, deps = {}) {
     localMcpAcknowledged: localMcpConsent?.acknowledged,
     activationCommand: configResult.activationCommand,
     skillInstalled: skillInstall?.installed,
+    signerRuntimePrepared,
     messages: [...consentMessages, ...localRuntimeInstall?.messages ?? [], ...configResult.messages, ...localProbeMessages, ...skillInstall?.messages ?? []]
   };
 }
@@ -1378,7 +1516,7 @@ async function configureClaudeCode(deps, localMcpCommand) {
     };
   }
 }
-async function configureClaudeCodeHosted(deps, input) {
+async function configureClaudeCodeHosted(deps, input, signerCommand) {
   const runCommand = deps.runCommand ?? defaultRunCommand;
   const hostedJson = JSON.stringify({
     type: "http",
@@ -1387,8 +1525,8 @@ async function configureClaudeCodeHosted(deps, input) {
   });
   const signerJson = JSON.stringify({
     type: "stdio",
-    command: "npx",
-    args: ["-y", signerPackageSpec(), "--credentials", input.signerPath],
+    command: signerCommand?.command ?? "npx",
+    args: signerCommand?.args ?? ["-y", signerPackageSpec(), "--credentials", input.signerPath],
     env: {}
   });
   try {
@@ -1429,7 +1567,7 @@ async function configureClaudeCodeHosted(deps, input) {
   }
 }
 async function defaultRunCommand(command, args) {
-  await execFileAsync2(command, args, { timeout: 1e4 });
+  await execFileAsync3(command, args, { timeout: 1e4 });
 }
 async function installClaudeSkill(homeDir) {
   try {
@@ -1512,6 +1650,14 @@ async function prepareRuntimeForLocalMcp(input, deps) {
     homeDir: deps.homeDir
   });
 }
+async function prepareSignerForRuntime(input, deps) {
+  const prepare = deps.prepareSignerRuntime ?? ((runtimeInput) => prepareSignerRuntime(runtimeInput, { runCommand: deps.runCommand }));
+  return prepare({
+    credentialDirectory: input.credentialDirectory,
+    signerPath: input.signerPath,
+    homeDir: deps.homeDir
+  });
+}
 async function runLocalMcpProbe(runtimeInstall, deps) {
   const probe = deps.probeLocalMcpTools ?? probeLocalMcpTools;
   try {
@@ -1528,7 +1674,7 @@ function localRuntimePrepareErrorCode(err) {
 }
 
 // src/runtime.ts
-var CONNECTOR_VERSION = "0.1.12-alpha.0";
+var CONNECTOR_VERSION = "0.1.13-alpha.0";
 async function runConnect(options, deps = {}) {
   const connectorVersion = options.connectorVersion ?? CONNECTOR_VERSION;
   const api = deps.api ?? createConnectApiClient(options.apiBaseUrl);
@@ -1767,6 +1913,6 @@ function requireValue(argv, index, option) {
   return value;
 }
 
-export { CONNECTOR_VERSION, MCP_RUNTIME_MANIFEST, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };
+export { CONNECTOR_VERSION, MCP_RUNTIME_MANIFEST, createConnectApiClient, defaultAgentDirectory, delegateKeyFromPrivateKey, generateDelegateKey, helpText, installRuntime, mcpPackageSpec, normalizeRuntime, parseArgs, prepareSignerRuntime, redactSecrets, runConnect, runtimeInstallCapabilities, runtimeProfile, sdkPackageSpec, shortAddress, signerPackageSpec, writeCredentialFiles };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map